Vulnerability Details CVE-2014-3445
backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.04
EPSS Ranking 88.0%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- http://packetstormsecurity.com/files/126844/HandsomeWeb-SOS-Webpages-1.1.11-Backup-Hash-Disclosure.html
- http://seclists.org/fulldisclosure/2014/May/130
- http://sourceforge.net/projects/soswebpages/files/SOS%20Webpages/SOS%20Webpages%201.1.12/
- http://www.securityfocus.com/bid/67644
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/
- http://packetstormsecurity.com/files/126844/HandsomeWeb-SOS-Webpages-1.1.11-Backup-Hash-Disclosure.html
- http://seclists.org/fulldisclosure/2014/May/130
- http://sourceforge.net/projects/soswebpages/files/SOS%20Webpages/SOS%20Webpages%201.1.12/
- http://www.securityfocus.com/bid/67644
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/
Products affected by CVE-2014-3445
-
cpe:2.3:a:handsomeweb:sos_webpages:-